#!/bin/bash

############################################################################
#
# 远程执行该脚本，请在命令行中直接执行以下命令：
#
#   curl -sSL https://gitee.com/tay3223/biubiubiu/raw/master/script-kubernetes/centos7-create-k8s-ca-crt.sh | /bin/bash
#
#
############################################################################

#--------------------------
# 创建工作目录
#--------------------------
mkdir -p /etc/etcd/pki
mkdir -p /etc/kubernetes/pki

#确保这些目录下是干净的
rm -rf /etc/etcd/pki/*
rm -rf /etc/kubernetes/pki/*



#--------------------------
# 生成ca根证书
#--------------------------
openssl genrsa -out /etc/kubernetes/pki/ca.key 2048

openssl req -new \
    -batch \
    -x509 \
    -days 3650 \
    -key /etc/kubernetes/pki/ca.key \
    -out /etc/kubernetes/pki/ca.crt



#--------------------------
# 生成etcd_server证书
#--------------------------
tee /etc/etcd/pki/etcd_ssl.cnf <<\EOF
[ req ]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[ req_distinguished_name ]

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ alt_names ]
IP.1 = 172.20.5.31
IP.2 = 172.20.5.32
IP.3 = 172.20.5.33
EOF

openssl genrsa -out /etc/etcd/pki/etcd_server.key 2048

openssl req -new \
    -batch \
    -config /etc/etcd/pki/etcd_ssl.cnf \
    -subj "/CN=etcd-server" \
    -key /etc/etcd/pki/etcd_server.key \
    -out /etc/etcd/pki/etcd_server.csr

openssl x509 -req \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -days 36500 \
    -CAcreateserial \
    -extensions v3_req \
    -extfile /etc/etcd/pki/etcd_ssl.cnf \
    -in /etc/etcd/pki/etcd_server.csr \
    -out /etc/etcd/pki/etcd_server.crt



#--------------------------
# 生成etcd_client证书
#--------------------------
openssl genrsa -out /etc/etcd/pki/etcd_client.key 2048

openssl req -new \
    -batch \
    -config /etc/etcd/pki/etcd_ssl.cnf \
    -subj "/CN=etcd-client" \
    -key /etc/etcd/pki/etcd_client.key \
    -out /etc/etcd/pki/etcd_client.csr

openssl x509 -req \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -days 36500 \
    -CAcreateserial \
    -extensions v3_req \
    -extfile /etc/etcd/pki/etcd_ssl.cnf \
    -in /etc/etcd/pki/etcd_client.csr \
    -out /etc/etcd/pki/etcd_client.crt



#--------------------------
# 创建k8s服务端证书
#--------------------------
tee /etc/kubernetes/pki/master_ssl.cnf <<\EOF
[ req ]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[ req_distinguished_name ]

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = kubernetes
DNS.1 = kubernetes.default
DNS.1 = kubernetes.default.svc
DNS.1 = kubernetes.default.svc.cluster.local
DNS.1 = master1
DNS.1 = master2
DNS.1 = master3
IP.1 = 169.169.0.1
IP.2 = 172.20.5.31
IP.3 = 172.20.5.32
IP.4 = 172.20.5.33
IP.5 = 172.20.5.41
EOF

openssl genrsa -out /etc/kubernetes/pki/apiserver.key 2048

openssl req -new \
    -batch \
    -config /etc/kubernetes/pki/master_ssl.cnf \
    -subj "/CN=kube-apiserver" \
    -key /etc/kubernetes/pki/apiserver.key \
    -out /etc/kubernetes/pki/apiserver.csr

openssl x509 -req \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -days 36500 \
    -CAcreateserial \
    -extensions v3_req \
    -extfile /etc/kubernetes/pki/master_ssl.cnf \
    -in /etc/kubernetes/pki/apiserver.csr \
    -out /etc/kubernetes/pki/apiserver.crt



#--------------------------
# 创建k8s客户端证书
#--------------------------
openssl genrsa -out /etc/kubernetes/pki/client.key 2048

openssl req -new \
    -batch \
    -subj "/CN=admin" \
    -key /etc/kubernetes/pki/client.key \
    -out /etc/kubernetes/pki/client.csr

openssl x509 -req \
    -CA /etc/kubernetes/pki/ca.crt \
    -CAkey /etc/kubernetes/pki/ca.key \
    -days 36500 \
    -CAcreateserial \
    -in /etc/kubernetes/pki/client.csr \
    -out /etc/kubernetes/pki/client.crt
